The cross-session reservation registry: one shared per-user-account pending total, bumped at
accept time, released at settle. add returns the post-add total, so accept screens are
add-then-check — two concurrent debits can never both read the same headroom, in one process
or across nodes. Share one registry across every session in the process
(createReservations), or across every node (sharedReservations, backed by the
store's counter). The settle replay path remains the backstop for crash-recovery windows
either way.
scope decides crash-recovery behavior: a process registry dies with its process, so
recoverSession re-applies the journaled reservations; a shared counter survives the
crash already holding them, so recovery must not re-apply — it would double-count.
The cross-session reservation registry: one shared per-user-account pending total, bumped at accept time, released at settle.
addreturns the post-add total, so accept screens are add-then-check — two concurrent debits can never both read the same headroom, in one process or across nodes. Share one registry across every session in the process (createReservations), or across every node (sharedReservations, backed by the store's counter). The settle replay path remains the backstop for crash-recovery windows either way.scopedecides crash-recovery behavior: aprocessregistry dies with its process, so recoverSession re-applies the journaled reservations; asharedcounter survives the crash already holding them, so recovery must not re-apply — it would double-count.